Blog
/
AI
/
March 11, 2025

Survey findings: AI Cyber Threats are a Reality, the People are Acting Now

Part 2/4: Darktrace releases insights on the State of AI in cybersecurity. This blog discusses AI’s impact on the cyber threat landscape.
Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
The Darktrace Community
Default blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog image
11
Mar 2025

Artificial intelligence is changing the cybersecurity field as fast as any other, both on the offensive and defensive side. We surveyed over 1,500 cybersecurity professionals from around the world to uncover their attitudes, understanding, and priorities when it comes to AI cybersecurity in 2025. Our full report, unearthing some telling trends, is out now.

Download the full report to explore these findings in depth

How is AI impacting the threat landscape?

state of ai in cybersecurity report graphic showing ai powered cyber threats having an impact on organizations

Nearly 74% of participants say AI-powered threats are a major challenge for their organization and 90% expect these threats to have a significant impact over the next one to two years, a slight increase from last year. These statistics highlight that AI is not just an emerging risk but a present and evolving one.

As attackers harness AI to automate and scale their operations, security teams must adapt just as quickly. Organizations that fail to prioritize AI-specific security measures risk falling behind, making proactive defense strategies more critical than ever.

Some of the most pressing AI-driven cyber threats include:

  • AI-powered social engineering: Attackers are leveraging AI to craft highly personalized and convincing phishing emails, making them harder to detect and more likely to bypass traditional defenses.
  • More advanced attacks at speed and scale: AI lowers the barrier for less skilled threat actors, allowing them to launch sophisticated attacks with minimal effort.
  • Attacks targeting AI systems: Cybercriminals are increasingly going after AI itself, compromising machine learning models, tampering with training data, and exploiting vulnerabilities in AI-driven applications and APIs.

Safe and secure use of AI

AI is having an effect on the cyber-threat landscape, but it also is starting to impact every aspect of a business – from marketing to HR to operations. The accessibility of AI tools for employees improves workflows, but also poses risks like data privacy violations, shadow AI, and violation of industry regulations.

How are security practitioners accommodating for this uptick in AI use across business?

Among survey participants 45% of security practitioners say they had already established a policy on the safe and secure use of AI and around 50% are in discussions to do so.

While almost all participants acknowledge that this is a topic that needs to be addressed, the gap between discussion and execution could underscore a need for greater insight, stronger leadership commitment, and adaptable security frameworks to keep pace with AI advancements in the workplace. The most popular actions taken are:

  1. Implemented security controls to prevent unwanted exposure of corporate data when using AI technology (67%)
  2. Implemented security controls to protect against other threats/risks associated with using AI technology (62%)

This year specifically, we see further action being taken with the implementation of security controls, training, and oversight.

For a more detailed breakdown that includes results based on industry and organizational size, download the full report here.

AI threats are rising, but security teams still face major challenges

78% of CISOs say AI-powered cyber-threats are already having a significant impact on their organization, a 5% increase from last year.

While cyber professionals feel more prepared for AI powered threats than they did 12 months ago, 45% still say their organization is not adequately prepared—down from 60% last year.

Despite this optimism, key challenges remain, including:

  • A shortage of personnel to manage tools and alerts
  • Gaps in knowledge and skills related to AI-driven countermeasures

Confidence in traditional security tools vs. new AI based tools

This year, 73% of survey participants expressed confidence in their security team’s proficiency in using AI within their tool stack, marking an increase from the previous year.

However, only 50% of participants have confidence in traditional cybersecurity tools to detect and block AI-powered threats. In contrast, 75% of participants are confident in AI-powered security solutions for detecting and blocking such threats and attacks.

As leading organizations continue to implement and optimize their use of AI, they are incorporating it into an increasing number of workflows. This growing familiarity with AI is likely to boost the confidence levels of practitioners even further.

The data indicates a clear trend towards greater reliance on AI-powered security solutions over traditional tools. As organizations become more adept at integrating AI into their operations, their confidence in these advanced technologies grows.

This shift underscores the importance of staying current with AI advancements and ensuring that security teams are well-trained in utilizing these tools effectively. The increasing confidence in AI-driven solutions reflects their potential to enhance cybersecurity measures and better protect against sophisticated threats.

State of AI report

Download the full report to explore these findings in depth

The full report for Darktrace’s State of AI Cybersecurity is out now. Download the paper to dig deeper into these trends, and see how results differ by industry, region, organization size, and job title.  

Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
The Darktrace Community

Blog

/

AI

/

September 26, 2025

One-Person Security Team, Enterprise-Wide Protection: A Utility Company’s Darktrace Success Story

Default blog imageDefault blog image

A critical mission: Securing public utility systems

This company manages essential utility infrastructure across more than 100 distributed sites, resulting in a wide attack surface spanning both information technology (IT) and operational technology (OT). With attacks on critical infrastructure rising, the company wanted to strengthen defenses.

The limits of traditional tools

The existing mix of conventional tools for visibility and security monitoring posed numerous limitations:

  • Fragmented tools required switching between dashboards to piece together insights
  • Multiple tools were required to both identify and take action on potential incidents
  • Integration between IT, OT, cloud and email required heavy manual effort
  • Existing cybersecurity investments were failing to deliver favorable ROI

A security team of one

For the company’s one-person security team and Vice President of IT, juggling multiple tools and switching between platforms were drains on his time and impacted threat detection and response times. “If an unknown actor attempts to connect to our networks, I need to know immediately and have the ability to stop them before they can do damage.”

Unified, AI-driven defense with Darktrace

The company wanted to unify IT and OT security, reduce manual workload and deliver actionable intelligence in real time. “Darktrace offered the visibility and autonomous capabilities we needed for a proactive defense, including the ability to both see incidents and take action through a single-pane-of-glass.”

Today, the company is using the Darktrace ActiveAI Security Platform™ as the cornerstone of its defense strategy, including:

Real-time protection without the overhead

When compared to a security operations center, the VP said Darktrace is faster, more efficient and more accurate – delivering holistic protection without the high cost or risk of human error.

Darktrace’s Autonomous Response has been a game changer for a shop our size. It stops attacks in real time, before they can move laterally. As a team of one, I can adjust Darktrace’s autonomous actions, ensuring the AI automatically takes stronger actions during off hours to contain threats.”

A single platform for holistic visibility and resilience

Initially licensed under an OT-only pricing model, the company quickly recognized the broader value of Darktrace Self-Learning AI – extending deployment across its IT, cloud, email and endpoint environments and consolidating multiple tools. This holistic visibility is also helping the company to meet ISO and SEC compliance requirements.

A rapid, guided and streamlined deployment

The VP described the Darktrace rollout as smooth and highly collaborative, noting that Darktrace, “Held our hand throughout the process and was genuinely interested in making sure our experience with the platform and the company was top notch.” Despite the complexity of managing multi-connectivity for 100 sites, rollout took less than one week, guided by a clear plan from the Darktrace implementation team.

From barriers to breakthroughs

A seamless security ecosystem

With Darktrace, the company now operates a seamless, AI-driven security ecosystem that combines deep threat validation, intuitive user experience, and a single pane of glass for holistic cyber defense. What began as an OT-focused deployment has grown into a platform that unifies IT, OT, cloud, email and endpoint visibility, delivering comprehensive protection without the overhead of managing multiple tools.

From false positives to real-time, autonomous precision

Since using Darktrace, the company’s false positives have decreased to single digits per day. Within three months, Darktrace conducted 1,470 total investigations, resolving 92% of those autonomously. And Darktrace consistently catches threats that other tools miss:

  • When a remote call center agent landed on a malware-laden site using their company device, the company’s endpoint solution failed to catch it. But Darktrace / ENDPOINT detected the malicious traffic in real time, immediately cutting the connection and blocking the machine from the home network – stopping the attack before it could spread.
  • Darktrace / EMAIL has consistently flagged suspicious messages other tools missed, including credential harvesters or malware disguised as legitimate emails. “Occasionally users request the release of a legitimate email, whether it’s a blocked link or a message diverted to junk. But 10% of those messages could have caused real harm,” said the VP. “And because Darktrace AI is always learning and adapting, it will identify similar legitimate emails in the future, reducing false positives. That tradeoff is well worth it.”

Time saved, confidence gained

For the VP, one of the biggest benefits is time. In less than one month, Darktrace saved the company 264 analyst hours spent on investigations, only escalating 8% of suspected threats for further review. And with Darktrace’s unified dashboard and real-time monitoring, the VP said, “I no longer have to spend time verifying each security tool is working because I can see everything in one location. And, if there is an issue, Darktrace will let me know. That gives me confidence to let the system handle threats while I focus on other priorities.”

Strengthening OT without complexity

The VP said Darktrace / OT has become one of the most valuable aspects of the deployment. Darktrace / OT provides visibility into firmware levels, PLC communications and unusual device interactions that even dedicated OT tools miss. And using Darktrace, the company can segment OT networks securely while still monitoring them through a single interface, strengthening resilience without adding complexity.

Turning cybersecurity into a business catalyst

By reducing tool sprawl, automating responses, and adapting to the unique rhythms of the organization, Darktrace has transformed the company’s cybersecurity from a constant worry into a reliable foundation.

For us, cybersecurity isn’t just about blocking threats, it’s about building resilience that frees us to focus on growth and innovation. With Darktrace as a trusted partner, we’re no longer stuck reacting to problems; we’re shaping a future where security is a catalyst, not a constraint.”
Continue reading
About the author
The Darktrace Community

Blog

/

Cloud

/

September 25, 2025

Announcing Unified Real-Time CDR and Automated Investigations to Transform Cloud Security Operations

Default blog imageDefault blog image

Fragmented Tools are Failing SOC Teams in the Cloud Era

The cloud has transformed how businesses operate, reshaping everything from infrastructure to application delivery. But cloud security has not kept pace. Most tools still rely on traditional models of logging, policy enforcement, and posture management; approaches that provide surface-level visibility but lack the depth to detect or investigate active attacks.

Meanwhile, attackers are exploiting vulnerabilities, delivering cloud-native exploits, and moving laterally in ways that posture management alone cannot catch fast enough. Critical evidence is often missed, and alerts lack the forensic depth SOC analysts need to separate noise from true risk. As a result, organizations remain exposed: research shows that nearly nine in ten organizations have suffered a critical cloud breach despite investing in existing security tools [1].

SOC teams are left buried in alerts without actionable context, while ephemeral workloads like containers and serverless functions vanish before evidence can be preserved. Point tools for logging or forensics only add complexity, with 82% of organizations using multiple platforms to investigate cloud incidents [2].

The result is a broken security model: posture tools surface risks but don’t connect them to active attacker behaviors, while investigation tools are too slow and fragmented to provide timely clarity. Security teams are left reactive, juggling multiple point solutions and still missing critical signals. What’s needed is a unified approach that combines real-time detection and response for active threats with automated investigation and cloud posture management in a single workflow.

Just as security teams once had to evolve beyond basic firewalls and antivirus into network and endpoint detection, response, and forensics, cloud security now requires its own next era: one that unifies detection, response, and investigation at the speed and scale of the cloud.

A Powerful Combination: Real-Time CDR + Automated Cloud Forensics

Darktrace / CLOUD now uniquely unites detection, investigation, and response into one workflow, powered by Self-Learning AI. This means every alert, from any tool in your stack, can instantly become actionable evidence and a complete investigation in minutes.

With this release, Darktrace / CLOUD delivers a more holistic approach to cloud defense, uniting real-time detection, response, and investigation with proactive risk reduction. The result is a single solution that helps security teams stay ahead of attackers while reducing complexity and blind spots.

  • Automated Cloud Forensic Investigations: Instantly capture and analyze volatile evidence from cloud assets, reducing investigation times from days to minutes and eliminating blind spots
  • Enhanced Cloud-Native Threat Detection: Detect advanced attacker behaviors such as lateral movement, privilege escalation, and command-and-control in real time
  • Enhanced Live Cloud Topology Mapping: Gain continuous insight into cloud environments, including ephemeral workloads, with live topology views that simplify investigations and expose anomalous activity
  • Agentless Scanning for Proactive Risk Reduction: Continuously monitor for misconfigurations, vulnerabilities, and risky exposures to reduce attack surface and stop threats before they escalate.

Automated Cloud Forensic Investigations

Darktrace / CLOUD now includes capabilities introduced with Darktrace / Forensic Acquisition & Investigation, triggering automated forensic acquisition the moment a threat is detected. This ensures ephemeral evidence, from disks and memory to containers and serverless workloads can be preserved instantly and analyzed in minutes, not days. The integration unites detection, response, and forensic investigation in a way that eliminates blind spots and reduces manual effort.

Figure 1: Easily view Forensic Investigation of a cloud resource within the Darktrace / CLOUD architecture map

Enhanced Cloud-Native Threat Detection

Darktrace / CLOUD strengthens its real-time behavioral detection to expose early attacker behaviors that logs alone cannot reveal. Enhanced cloud-native detection capabilities include:

• Reconnaissance & Discovery – Detects enumeration and probing activity post-compromise.

• Privilege Escalation via Role Assumption – Identifies suspicious attempts to gain elevated access.

• Malicious Compute Resource Usage – Flags threats such as crypto mining or spam operations.

These enhancements ensure active attacks are detected earlier, before adversaries can escalate or move laterally through cloud environments.

Figure 2: Cyber AI Analyst summary of anomalous behavior for privilege escalation and establishing persistence.

Enhanced Live Cloud Topology Mapping

New enhancements to live topology provide real-time mapping of cloud environments, attacker movement, and anomalous behavior. This dynamic visibility helps SOC teams quickly understand complex environments, trace attack paths, and prioritize response. By integrating with Darktrace / Proactive Exposure Management (PEM), these insights extend beyond the cloud, offering a unified view of risks across networks, endpoints, SaaS, and identity — giving teams the context needed to act with confidence.

Figure 3: Enhanced live topology maps unify visibility across architectures, identities, network connections and more.

Agentless Scanning for Proactive Risk Reduction

Darktrace / CLOUD now introduces agentless scanning to uncover malware and vulnerabilities in cloud assets without impacting performance. This lightweight, non-disruptive approach provides deep visibility into cloud workloads and surfaces risks before attackers can exploit them. By continuously monitoring for misconfigurations and exposures, the solution strengthens posture management and reduces attack surface across hybrid and multi-cloud environments.

Figure 4: Agentless scanning of cloud assets reveals vulnerabilities, which are prioritized by severity.

Together, these capabilities move cloud security operations from reactive to proactive, empowering security teams to detect novel threats in real time, reduce exposures before they are exploited, and accelerate investigations with forensic depth. The result is faster triage, shorter MTTR, and reduced business risk — all delivered in a single, AI-native solution built for hybrid and multi-cloud environments.

Accelerating the Evolution of Cloud Security

Cloud security has long been fragmented, forcing teams to stitch together posture tools, log-based monitoring, and external forensics to get even partial coverage. With this release, Darktrace / CLOUD delivers a holistic, unified approach that covers every stage of the cloud lifecycle, from proactive posture management and risk identification to real-time detection, to automated investigation and response.

By bringing these capabilities together in a single AI-native solution, Darktrace is advancing cloud security beyond incremental change and setting a new standard for how organizations protect their hybrid and multi-cloud environments.

With Darktrace / CLOUD, security teams finally gain end-to-end visibility, response, and investigation at the speed of the cloud, transforming cloud defense from fragmented and reactive to unified and proactive.

[related-resource]

Sources: [1], [2] Darktrace Report: Organizations Require a New Approach to Handle Investigations in the Cloud

Continue reading
About the author
Adam Stevens
Senior Director of Product, Cloud | Darktrace
Your data. Our AI.
Elevate your network security with Darktrace AI